System and method for checking default configuration settings of device on a network

Abstract

A method and system for securely verifying security compliance of a device on a network by generating a hash value for configuration data of the device, sending this value to a compliance service agent, comparing the hash value with hash value of default configuration data of the device, and reporting security non-compliance of the device when the generated hash value is same as the default hash values.

What is claimed is: 
     
       1. A method for verifying security compliance of one or more devices on a network, said method comprising:
 receiving, by a server, a generated hash value from a processing circuit for configuration data of a device of the one or more devices on the network; 
 comparing, by the server, the hash value received from the processing circuit with a pre-determined hash value for said configuration data of said device, wherein the pre-determined hash value is based on a default password of said device, wherein the default password is set at the time of manufacture or installation of the device, wherein said device is determined as security non-compliant when the received hash value is equal to the pre-determined hash value, and said device is determined as security compliant when the received hash value is different than the pre-determined hash value; 
 in response to determining that the device is security non-compliant:
 generating, by the server, a flag signal reporting the security non-compliance of the device; 
 providing an alert that the device is security non-compliant; and 
 displaying details of the device being security non-compliant, the details including the alert and an action to be taken; 
 
 in response to determining that the device is security compliant:
 periodically comparing a new hash value for the configuration data of the device against an updated pre-determined hash value to determine whether the device remains security compliant; and 
 
 generating a report of a security compliance status of the one or more devices on the network. 
 
     
     
       2. The method of  claim 1 , wherein generating the hash value further comprises:
 analyzing, the configuration data by employing hash function; and 
 determining, the hash value based on the analysis of the configuration data. 
 
     
     
       3. The method of  claim 1 , wherein comparing the hash values further comprises:
 determining, the configuration data for which the hash value is received; 
 extracting, the pre-determined hash value corresponding to the determined configuration data of said device from a repository, wherein said repository is configured to store pre-determined hash values corresponding to multiple configuration data for each device on said network; and 
 utilizing, the pre-determined hash value extracted from the repository for comparison with the hash value received from the processing circuit. 
 
     
     
       4. The method of  claim 1 , further comprising:
 generating, a logic high signal when the received hash value is equal to the pre-determined hash value indicating security non-compliance of said device; and 
 reporting, security non-compliance of the device upon generation of the logic high signal. 
 
     
     
       5. The method of  claim 1 , wherein said configuration data is a password, and the generated hash value is a present password. 
     
     
       6. The method of  claim 1 , further comprising:
 transmitting, the generated hash value to the server as a message, wherein said generated hash value is part of said message. 
 
     
     
       7. The method of  claim 1 , wherein said configuration data comprises at least one of port data, status of Secure Socket Shell (SSH), status of Telnet, password, and firmware version. 
     
     
       8. A method for verifying security compliance of a device on a network, the method comprising:
 receiving, by a configuration compliance evaluator, a generated hash value from a processing circuit for configuration data of said device; 
 comparing, by the configuration compliance evaluator, the hash value received from the processing circuit with a pre-determined hash value for default authentication credentials of said device, wherein the default authentication credentials include a default password of said device, wherein the default password is set at the time of manufacture or installation of the device, wherein said device is determined as security non-compliant when the received hash value is equal to the pre-determined hash value, and said device is determined as security compliant when the received hash value is different than the pre-determined hash value; 
 in response to determining that the device is security non-compliant:
 generating, by the configuration compliance evaluator, a flag signal reporting the security non-compliance of the device; 
 providing an alert that the device is security non-compliant; and 
 displaying details of the device being security non-compliant, the details including the alert and an action to be taken; 
 
 in response to determining that the device is security compliant:
 periodically comparing a new hash value for the configuration data of the device against an updated pre-determined hash value to determine whether the device remains security compliant; and 
 
 generating a report of a security compliance status of one or more devices on the network. 
 
     
     
       9. The method of  claim 8 , further comprising:
 generating, by the configuration compliance evaluator, a logic high signal when the received hash value is equal to the pre-determined hash value indicating security non-compliance of said device; and 
 reporting, by the configuration compliance evaluator, security non-compliance of the device upon generation of the logic high signal. 
 
     
     
       10. The method of  claim 8 , further comprising:
 extracting, by the configuration compliance evaluator, the pre-determined hash value for said device from a repository, wherein said repository is configured to store pre-determined hash values corresponding to a plurality of devices on said network; and 
 utilizing, by the configuration compliance evaluator, the pre-determined hash value extracted from the repository for comparison with the hash value received from the processing circuit. 
 
     
     
       11. The method of  claim 8 , further comprising:
 generating, by the configuration compliance evaluator, a logic low signal when the received hash value and the pre-determined hash value are different; 
 updating, by the configuration compliance evaluator, the pre-determined hash value with the received hash value in said repository upon generation of the logic low signal; and 
 periodically compare, by the configuration compliance evaluator, the received hash value of authentication credentials and said updated pre-determined hash value for said device to determine security non-compliance of said device. 
 
     
     
       12. A system for verifying security compliance of a device on a network, said system comprising:
 a server configured to receive a received hash value generated by employing a hash function on configuration data of said device, the server having:
 a repository configured to store a pre-determined hash value for the configuration data of said device; and 
 one or more processors configured to:
 compare the received hash value with the pre-determined hash value, wherein the pre-determined hash value is based on a default password of said device, wherein the default password is set at the time of manufacture or installation of the device, wherein said device is determined as security non-compliant when the received hash value is equal to the pre-determined hash value, and said device is determined as security compliant when the received hash value is different than the pre-determined hash value; 
 in response to determining that the device is security non-compliant:
 generate a flag signal reporting security non-compliance of the device; 
 provide an alert that the device is security non-compliant; and 
 display details of the device being security non-compliant, the details including the alert and an action to be taken; 
 
 in response to determining that the device is security compliant:
 periodically compare a new hash value for the configuration data of the device against an updated pre-determined hash value to determine whether the device remains security compliant; and 
 
 generate a report of a security compliance status of one or more devices on the network. 
 
 
 
     
     
       13. The system of  claim 12 , wherein the one or more processors are further configured to:
 determine the configuration data for the received hash value and extract the pre-determined hash value corresponding to the determined configuration data from the repository; and 
 compare the received hash value with the pre-determined hash value extracted from the repository, and generate a logic high signal indicating security non-compliance of said device, when the received hash value is equal to the pre-determined hash value. 
 
     
     
       14. The system of  claim 12 , wherein the one or more processors are further configured to:
 generate a logic low signal when the received hash value and the pre-determined hash value are different; 
 update the pre-determined hash value with the received hash value in said repository; and 
 periodically compare the received hash value of configuration data and said updated pre-determined hash value for said device to determine security compliance of said device. 
 
     
     
       15. The system of  claim 13 , wherein the one or more processors are further configured to generate a flag signal reporting security non-compliance of said device upon generation of the logic high signal. 
     
     
       16. The system of  claim 12 , wherein said configuration data comprises a present password. 
     
     
       17. The system of  claim 12 , further comprising a processing circuit configured to transmit the received hash value to the server as part of a heartbeat message, and wherein the server is configured to receive the received hash value from the heartbeat message. 
     
     
       18. The system of  claim 12 , wherein said pre-determined hash value is associated with default configuration data applied during manufacturing or installation. 
     
     
       19. The system of  claim 12 , further comprising a processing circuit having:
 a memory configured to store the hash function; and 
 a processor configured to:
 analyze the configuration data by employing the hash function; and 
 determine the received hash value for the analyzed configuration data. 
 
 
     
     
       20. The system of  claim 12 , wherein said server shares a same or different network with the device being verified for security compliance.